Re: Zsh - Multiple DoS Vulnerabilities

[Peter Stephenson <p.stephenson@xxxxxxxxxxx>]

On Fri, 2019-05-10 at 13:27 -0700, Bart Schaefer wrote:
> On Fri, May 10, 2019 at 8:04 AM David Wells <bughunters@xxxxxxxxxxx> wrote:
> > 
> > 
> >     #1 Invalid read from *taddrstr *call in *text.c*
> >     POC folder: *01_taddstr_(text.c_148)*
> This has literal NUL bytes embedded in the body of an if/then.  Run
> from an interactive shell, it gives:
> 
>  text.c:995: unknown word code in gettext2()
>  text.c:995: unknown word code in gettext2()
>  text.c:72: attempting to decrement tindent below zero
>  text.c:72: attempting to decrement tindent below zero
> 
> and then (several seconds later) a crash.
> 
> The following minimal subset of their test will put the shell into an
> infinite loop, without (at least for as long as I was willing to wait)
> crashing it:
> 
> if true; then me > you || !
> :
> fi

So the best guess at the moment is the embedded NUL bytes are being
misinterpreted by whatever causes the text to be handled wrongly, so
they are only tangentially relevant?

That would fit with what I'm seeing, which is the infinite loop is in
gettext2(), before anything is executed.  This function tries to decode
wordcode set up by the parser, which is hard to debug because of the
strong correlation between the two completely separate bits of code (and
its own internal structure is a bit head-scratching, too).  Might be
interesting to perturb it until it just doesn't fail any more...

The parsing phase seemed to finish normally, as far as I could see.

pws